SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillslaunch-review

launch-review

General & other

View repository

Updated 10-15 20:29

About this skill

/launch-review
  1. Load ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md → framework + calibration. Stop if placeholder.
  2. Fetch PRD + related docs. If tracker connected, pull ticket and comments.
  3. Walk each framework category using the workflow below.
  4. Calibrate each finding against the calibration table. New = flagged explicitly.
  5. Output the review memo in the internal format. If connected, post summary to the ticket.
  6. Handoff: if heavy marketing, route to marketing-claims-review; if a finding needs deep analysis, route to feature-risk-assessment.
/product-legal:launch-review PROJ-1234

Matter context

Matter context. Check the practice-level CLAUDE.md for ## 事项工作空间. If Enabled is ✗(the default for enterprise legal users), skip the rest of this section—the skill uses practice-level context and the matter mechanism is invisible. If enabled and there is no active matter, ask: "Which matter is this? Run /product-legal:matter-workspace switch <事项简称> or say 实务级." Load the active matter's matter.md for matter-specific context and override rules. Output is written to the matter folder ~/.claude/plugins/config/claude-for-legal-zh/product-legal/matters/<事项简称>/. Never read files from other matters unless 跨事项上下文 is 开.

Destination check

Before producing output, check where it is going. If the user specified a destination (channel, distribution list, counterparty, "everyone"), ask whether it is within the confidentiality perimeter. Public channels, company-wide lists, counterparties/opposing counsel, vendors, and customers (for work product) will cause loss of protection. When the destination appears to be outside the confidentiality perimeter, flag it and offer (a) a legal-only confidential version, (b) a sanitized version suitable for a broader channel, or (c) both—do not silently add a confidentiality header and then help paste it somewhere the header cannot protect. See ## 共享安全机制 → 发送目的地检查。

Purpose

Read the PRD, check every category in the team's framework, calibrate against what actually blocks here (based on ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md), and output the review in the internal format. Goal: the PM finishes reading and knows exactly what must be done before launch.

Load calibration

Read ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md：

  • ## 审查框架—categories to check
  • ## 风险校准—inthis companywhat blocks vs. what is an FYI
  • ## 产品上线审查流程—output format
  • ## 上报—when to escalate

The calibration table is the difference between this skill and a generic checklist. If the table says "new data collection → PIA required, 1-2 days to launch," do not write "this may require a full DPIA and regulatory consultation." Match the team's actual practice.

Workflow

Step 1: Gather inputs

  • PRD—from a file, Feishu doc, or launch tracker ticket
  • Spec/design doc—if separate
  • Marketing plan—if any (if heavy marketing, hand off to marketing-claims-review)
  • Launch date—for urgency calibration
  • Launch tracker ticket——If already connected, pull to get context and comments

If Feishu Bitable/DingTalk/Teambition MCP is already connected, pull ticket history—the context usually not captured in the PRD is in early comments.

Step 2: Understand the launch content

Before checking the checklist, answer in plain language:

  • What does this thing do?
  • Who uses it—existing users, new users, new groups?
  • What is new vs. what is an extension of something already reviewed?
  • Is there any new data, new vendor, new promotion, new jurisdiction?

AI detection—run before traversing the framework. Check whether this launch uses AI in any form: third-party models, internally built models, AI-enabled vendor features, automated scoring or classification, generated content, recommendations, predictions. Look for it even if the PRD does not label it "AI"—words such as "intelligent," "automatic," "personalized," "generated," and "recommended" are signals.

If an AI component is detected → flag it, then run while traversing the framework /ai-governance-legal:use-case-triage [功能]. Category 8 below handles the details; this flag ensures it is never skipped even if the PRD is vague.

Step 3: Traverse the framework

For ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md → review each category in the framework. If the team does not have one, use the following 8-category default framework. Categories are stable framework concepts; within each category, before calibrating severity, retrieve the regulatory regimes applicable to the product domain, audience, and jurisdiction. What is blocking in one jurisdiction or domain may be routine in another—~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md capture the team's calibration.

# Category Key questions Auto-skip conditions
1 Contractual commitments Does it conflict with any customer-facing commitment (terms of service, SLA, marketing)? No customer-facing changes
2 Personal information protection New data collection, new purposes, new sharing? No data changes
3 Data security New attack surface, new data at rest, new access patterns? UI-only changes, no backend changes
4 Intellectual property Third-party code/content? Open-source license checks? Potentially infringing outputs? No new dependencies, no user-generated content
5 Third-party cooperation New vendor, partner, or integration? No new external parties
6 Industry regulation Does it involve a regulated field, audience, or jurisdiction? Retrieve the applicable regimes. Same users, field, and jurisdiction as the existing product

No silent supplementation. If a retrieval query against the configured legal research tool returns few or no results, report what was retrieved and stop. Do not fill in from web search or model knowledge without asking. Say: "[tool] search returned [N] results. Coverage of [regime/topic] appears limited. Options: (1) expand the retrieval query, (2) try a different research tool, (3) search the web—results will be flagged [联网检索 — 需复核], and before relying on them they should be verified against the issuing authority, or (4) mark as unverified and stop. Which do you choose?" It is for the lawyer to decide whether to accept lower-confidence sources.

Source attribution layering. Mark each citation under review with its source. For model-knowledge citations, use three tiers rather than a single blanket "needs verification" label:

  • [已确认] — Stable, well-known statutory and regulatory citations unlikely to have changed (such as Article 9 of the Advertising Law, Article 13 of the Personal Information Protection Law, and Article 8 of the Anti-Unfair Competition Law as concepts). Relying on them still requires verification before launch, but at lower priority.
  • [需验证] — Model-knowledge citations are genuine but should be verified: specific implementing rules, regulatory guidance, enforcement actions, court judgments, thresholds, effective dates, and post-2024 amendments.
  • [需精准核实] — Precise citations (specific articles and items, judicial interpretation numbers, case numbers) carry the highest fabrication risk and should always be verified against the original source.

Tool-retrieved citations retain their source label ([北大法宝]、[威科先行]、[监管机构网站]or MCP tool name); web search citations retain [联网检索 — 需复核]; user-provided citations (from the PRD or seed materials) retain [用户提供]. Tiering makes genuine verification work stand out — someone who verifies everything verifies nothing. Never strip or collapse labels.

[平台政策 — 需对照现行规则核实] — Platform rules (Apple App Store Review Guidelines, Huawei AppGallery, WeChat Mini Program, Alipay Mini Program, and other rules) cited without retrieving the current policy page. Platform policies never use [已确认] — these may change without notice, and model snapshots are almost always lagging. If launch depends on a platform rule, retrieve the current policy page in-session before relying on it. | 7 | Marketing claims | Are there any claims that need substantiation? | No marketing component | | 8 | AI governance | Is AI used in any form? Is the use case in the register? Has algorithmic filing been completed? Have vendor AI terms been reviewed? | No AI component detected in Step 2 |

For each category, output:

### [N]. [类别]

**已检查：**[您看了什么]
**发现：**[清晰 | 需要修复 | 阻断 | 已跳过]
**详情：**[有什么问题，如有——具体到PRD，不泛泛]
**校准：**[依据配置 CLAUDE.md —— 这通常是FYI告知/通常需要X/通常阻断]
**行动：**[需要做什么，谁负责，何时完成]

Skip automatically and honestly. If a category does not apply, state the reason in one sentence. Do not pad.

Industry prompts. The above 8-category framework is aimed at enterprise SaaS products. If the launch involves any of the following industries, add an overlay: for each affected category, ask the overlay question alongside the base framework question, and surface the industry-specific regime before calibrating severity. A launch that checked all 8 boxes but missed an industry regime still has gaps.

Industry Overlay regime to surface
Children/minors Law on the Protection of Minors, Article 31 of the Personal Information Protection Law (under 14 years of age), Provisions on the Cyber Protection of Children's Personal Information, game anti-addiction regulations, Advertising Law provisions on the protection of minors
Games/in-app purchases/virtual currency Game publishing license numbers, anti-addiction systems, age-appropriateness notices, virtual currency management regulations, probability disclosure requirements (relevant provisions of the former Ministry of Culture/National Press and Publication Administration), app store policies (Apple, Huawei, WeChat Mini Program)
Finance/fintech Regulations of the People's Bank of China/National Financial Regulatory Administration/China Securities Regulatory Commission, Provisions on the Administration of Financial Information Services, payment business licenses, Regulations on the Administration of Credit Reporting Business, application of the Personal Information Protection Law in the financial sector
Health/medical Measures for the Administration of Internet Diagnosis and Treatment, Measures for the Administration of Standards/Security/Services of Health and Medical Big Data, Article 28 of the Personal Information Protection Law (sensitive personal information — medical health), medical device software (if applicable)
Education Education App filing, Provisions on the Protection of Minors in Schools, Personal Information Protection in Online Education, Measures for the Administration of Filing of Educational Mobile Internet Applications
Employment/HR Technology Labor Contract Law, Employment Promotion Law, application of the Personal Information Protection Law in human resource management, AI recruitment compliance, biometric information protection
Government/Public Sector Cybersecurity Multi-Level Protection Scheme, Critical Information Infrastructure Security Protection, Government Procurement Law and Regulations, Government Information System Government Procurement Management
Consumer/Retail/Marketing Advertising Law, Anti-Unfair Competition Law, Consumer Rights and Interests Protection Law, E-Commerce Law, Provisions on Clearly Marking Prices and Prohibiting Price Fraud, Provisions on Automatic Renewal

If an industry prompt is triggered and the base framework has no dedicated category covering it, insert it as a new category (for example "6a. Industry Coverage — Law on the Protection of Minors + Article 31 of the Personal Information Protection Law"). Do not let it disappear into Category 6 "Industry Regulation" as an afterthought; industry regimes typically provide a controlling floor, not a footnote.

Step 4: Calibrate Severity

For each finding, check against the calibration table in ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md :

  • If it matches the "usually FYI notification" pattern → note it, do not block
  • If it matches "usually requires effort" → specify the specific work, estimate the timeline from the table
  • If it matches "usually blocks" → flag prominently, escalate per the escalation table
  • If it isentirely new(not in the table) → state explicitly: "This does not match any pattern in the calibration — requires human judgment"

Step 5: Assemble the Review

Format based on ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md → Product Launch Review Process → Output Format. Prefix with the work product header in ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md ## 输出规范 (varies by user role — see ## 使用者). If no internal format is specified:

[工作成果页眉 — 按插件配置 ## 输出规范]

# 上线审查：[功能名称]

**审查日期：**[日期] | **上线日期：**[日期] | **审查人：**[姓名]
**PRD：**[链接] | **工单：**[链接，如已连接]

---

## 底线

[一段话：能否上线？必须首先完成什么？]

**判断：**[可上线 | 有条件上线 | 因X而阻断 | 需上报]

> **在对"可上线"或"有条件上线"判断输出前：** 读取 `~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md` 中的 `## 使用者`。如果角色为非法务人员：
>
> > 通过一项上线是一项法律行为——一旦产品上线，公司即承诺于此文件记录的法律立场。您是否已与律师审查？如已审查，继续。如未审查，以下是带给律师的简要说明：
> >
> > [生成1页摘要：上线内容、按类别分列发现、未决问题、条件履行后的剩余风险，以及上线前向律师提出的三个问题。]
> >
> > 如需要寻找律师：中华全国律师协会或所在地地方律师协会的推荐服务是最快的起点。
>
> 在未获得明确同意前，不越过此准入口输出"可上线"或"有条件上线"判断。"因X阻断"和"需上报"不需要准入——这些是审查判断，不是放行。

---

## 按类别分列发现

[所有第3步的类别块——跳过的类别放在底部]

---

## 行动事项

| # | 事项 | 负责人 | 截止日 | 是否阻断？ |
|---|---|---|---|---|
| 1 | [具体] | [产品经理/开发/法务] | [日期] | 是/否 |

---

## 上报事项

[如有——谁、为什么、按上报技能起草]

---

## 下次注意事项

[如果本次上线揭示了一个应更新校准表的模式]

---

## 引用检查

本审查中引用的任何案例、法律、法规或执法行动均由AI模型生成且未经原始来源验证。在依赖引用于上线决策之前，对照法律研究工具（北大法宝、威科先行、法信或您的律所研究平台）核实其准确性、有效性和当前执法态势。上线审查中被编造或错误引用的引用可能将业务引向错误方向。每条引用上的来源标签（如 `[北大法宝]`、`[联网检索 — 需复核]`）显示其来源；`需验证` 标签具有较高的编造风险，应首先检查。

Step 6: Produce two outputs — the confidential memorandum and the sanitized ticket comment

⚠️ Confidentiality warning: Posting the full confidential memorandum to a Feishu Bitable/DingTalk/Teambition ticket widely shared with developers, product managers, and other non-legal roles may result in loss of confidentiality privilege. Do not paste the full memorandum into a widely shared ticket.

Both of the following are required outputs of this skill. Neither is optional. Print in the order below, with a clear separator between them, so the user does not miss the sanitized content block.

Output 1 — Confidential Launch Review Memorandum. The full analysis assembled in Step 5: work product header, bottom line, findings by category (with risk rationale), action items, escalation items, next-time considerations, citation check. This is internal legal work product. Save it in your matter file (Feishu Docs, DMS, or ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md the review document storage location specified). Distribute only to those within the confidentiality circle.

Output 2 — Sanitized Ticket Comment Block — safe to post to the tracker. After the memorandum, with a clear --- separator and the heading ## 安全发布至追踪器（非保密）, produce a short comment block containing only:

  • Launch status: Green/Yellow/Red (i.e., ready to launch / conditional launch / blocked by X / needs escalation)
  • Conditions as action items: Each condition is one line, written as an instruction to the product manager/developer ("Attach the personal information protection impact assessment link to the ticket before launch" "Remove the wording 'most accurate' from the homepage copy"). No legal reasoning.
  • The deadline for each condition.
  • The owner of each condition.

The sanitized block does not contain work product/confidentiality headers, risk rationale, internal legal discussion, regulatory citations, or escalation notes. If the wording of a condition would leak the underlying legal theory ("administrative penalty risk"), rewrite it as an action ("Please have the legal lead confirm before launch").

Separator lines and block example:

---

## 安全发布至追踪器（非保密）

**上线状态：** 因以下条件阻断。

**条件：**
- [ ] 将完成的个人信息保护影响评估附至工单——负责人：[产品经理]——截止：[日期]
- [ ] 从首页草稿中删除"市场最准确"文案——负责人：[市场部]——截止：[日期]
- [ ] 在更改数据留存窗口前与法务负责人确认——负责人：[产品经理]——截止：[日期]

Paste Output 2 (and only Output 2) into the tracker. Send only the Output 1 link to the confidential circle members who need to read the full analysis.

Handoff

  • To marketing claims review: If there are many marketing components, hand off the claims portion.
  • To feature risk assessment: If a finding is complex enough to require a standalone document (e.g., a novel AI feature, children's product), generate a more in-depth assessment.
  • To personal information protection: If the launch involves personal data, run /privacy-legal:use-case-triage [功能]. If the triage returns "personal information protection impact assessment required" or "data protection impact assessment required," run /privacy-legal:pia-generation [功能]. Do not merely note "PIA required"—trigger it directly.
  • To AI governance: If Step 2 detects an AI component, run /ai-governance-legal:use-case-triage [功能]. If the triage returns "conditional," run /ai-governance-legal:aia-generation [功能]. If a new AI vendor is involved, run /ai-governance-legal:vendor-ai-review [供应商协议]。

Close with the next-step decision tree

Close with the next-step decision tree in CLAUDE.md ## 输出规范 . Customize the options to what this skill has just produced—the five default branches (draft X, escalate, gather facts, monitor and wait, other) are a starting point, not locked in. The decision tree is the output; the lawyer makes the choice.

What this skill does not do

  • It does not replace a conversation with the product manager. Often the PRD is wrong or outdated—the review reveals the problem, and a human asks the question.
  • It does not approve the launch. It informs approval.
  • It does not retroactively calibrate. If this launch turns out well (or badly) and the calibration table should be updated in some way, a human updates ~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.md。